feat(spam): score messages at ingest and hide likely spam

Add an optional, off-by-default spam-detection feature that scores each
message's spam likelihood at ingest, stores the score on the row, and lets
the display layer hide likely-spam by default behind a "show potential spam"
toggle. Nothing is ever dropped at ingest, so the threshold can be retuned
without reprocessing.

Scoring (collector/spam.py): windowed COUNT(*) over new
(path_prefix, received_at) and (sender_normalized, received_at) indexes —
joint path+sender signal plus a sender-name signal (trailing-digit suffix
stripped so bob1/bob2 collapse to bob). When the path is short/zero-hop or
absent, the name signal stands alone at full weight so local spam is still
flaggable. A background sweep re-scores recent rows with hindsight to catch
the leading edge of bursts. The collector logs each score (WARNING at/above
the threshold).

Display: the messages API gains include_spam and a master-switch-aware
hide-filter; the SPA shows the toggle + a badge only when the feature is on.

Config: FEATURE_SPAM_DETECTION is the single operator switch, bridged in
Compose to the backend SPAM_DETECTION_ENABLED for collector + api (mirrors
the FEATURE_PACKETS / RAW_PACKET_CAPTURE_ENABLED pattern). Both default off.

Works on SQLite and Postgres: DB-agnostic queries, an Alembic batch migration
for the three new columns + two indexes, and backend-aware collector test
fixtures (lifted db_backend/db_url into the shared conftest).

Also: move the meshcore-hub image pull_policy out of the base compose file.
It lived in docker-compose.yml as pull_policy: daily and made `make up` pull
the published image over a freshly built local one. Base is now policy-neutral
(default missing); dev sets pull_policy: build on the hub services so it only
ever uses local builds. Prod refreshes images via a manual `docker compose
... pull`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.dev.yml

@@ -7,7 +7,11 @@
 #   docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d
 
 services:
+  # Hub services (collector/api/web/migrate/seed) build from local source and
+  # never pull the published image in development (pull_policy: build), so
+  # `make build` + `make up` cannot clobber a local build with a registry pull.
   collector:
+    pull_policy: build
     depends_on:
       migrate:
         condition: service_completed_successfully
@@ -19,13 +23,21 @@ services:
       - "${MQTT_PORT:-1883}:${MQTT_PORT:-1883}"
 
   api:
+    pull_policy: build
     ports:
       - "${API_PORT:-8000}:8000"
 
   web:
+    pull_policy: build
     ports:
       - "${WEB_PORT:-8080}:8080"
 
+  migrate:
+    pull_policy: build
+
+  seed:
+    pull_policy: build
+
   redis:
     ports:
       - "${REDIS_PORT:-6379}:6379"